JP2008146213A - Device management device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To monitor and prevent unauthorized use or trouble while device management cannot be performed properly, and to quickly restore the correct device state when the state for properly managing the device is recovered. <P>SOLUTION: A device management device 1000 includes: a device management execution part 1400 which performs a predetermined management of a device 20 by executing device management functions 2300 provided in the device 20; and an event detection unit 1100 which detects a particular device management event. The device management execution unit 1400 determines the device management function 2300 to be executed in accordance with the detection result of the particular device management event and the device state. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a device management apparatus, for example, a device management apparatus that performs predetermined management for a device (for example, a mobile terminal) that is driven by a battery and is connected to the outside wirelessly.

  Conventionally, a management group (such as an administrator in a corporation) has been assigned to a device (for example, a mobile terminal) that is portable and can be connected to a network, such as a smart phone, a PDA, or a notebook PC. An apparatus (that is, a device management apparatus) capable of grasping a device state and setting and performing appropriate management (device management) for the device is referred to as “OMA Device Management (DM)” as “Open”. It is defined in “Mobile Alliance (OMA)”.

  In OMA-DM, the above-described device management can be realized by communication between a DM server and a DM client installed in a device.

  For example, each DM client notifies the DM server of the version of the firmware being driven by the device, and the DM server discovers a device having a lower version firmware based on the notification, and the device The DM client installed in the device is notified of a command for instructing appropriate firmware update.

  As the application range of mobile application services expands, the diversity of devices and the environment surrounding them has increased. For this reason, it becomes difficult to track the state and settings of the device, and the cost for the above-described device management becomes very high. In response to such market demands, there is a need for a device management mechanism that is more flexible and has high cost performance.

  In Non-Patent Document 1, which will be described later, “DM scheduling” is defined in order to reduce the network operation cost of the DM server.

  In such DM scheduling, a device that can be processed by a DM client installed in the device so that the DM server can perform device management processing offline (that is, in a state where there is no session with the DM server). The architecture that can notify the DM client in advance of the task schedule of the management function is described. The architecture, the function of the component included in the architecture, the interface between the component, the data structure of the management object, It defines the conditions for executing the schedule process.

In such an architecture, a scheduler is provided for each device, and the scheduler is configured to realize device management based on a task schedule.
OMA-AD-DM-Scheduling-V1_0-20060124-D

  As described above, according to Non-Patent Document 1, device management can be performed by the DM scheduler even when there is no session between the DM server and the DM client.

  However, there are situations in which the status of the DM server or DM client changes, and the above-described scheduler cannot detect an event that triggers device management or cannot perform device management according to the detection result of the event. is there.

  For example, such a situation is assumed to be a situation in which a device is powered off, network quality is degraded, a DM server is down, or the like. In such a situation, there is a problem that the task schedule cannot be processed properly and device management cannot be performed properly.

  Therefore, in such a situation, immediately before the above device management cannot be properly performed in each device, a special device management function is forcibly executed so that the device management cannot be performed properly. It is necessary to monitor and prevent fraud and malfunctions.

  In addition, when each device is restored to a state where such device management can be performed properly (power-on, network quality improvement, DM server restoration, etc.), the device state should be restored to the original state as soon as possible. There is a need.

  Therefore, the present invention has been made in view of the above-described problems, and can monitor and prevent fraud and malfunction while device management cannot be properly performed, and can appropriately perform such device management. It is an object of the present invention to provide a device management apparatus that enables quick restoration to the original device state when the situation is restored.

  A first feature of the present invention is a device management apparatus, which executes a device management function provided in a device, thereby performing a predetermined management for the device, and a specific device management An event detection unit for detecting an event, wherein the device management execution unit determines the device management function to be executed according to a detection result of the specific device management event and a device state. And

  In the first feature of the present invention, the state setting unit that sets the device state according to the detection result of the specific device management event, and the plurality of device management policies that specify the device management function, A policy management unit configured to set a device management policy to be used in accordance with the device status set by the status setting unit and a detection result of the specific device management event, and the device management execution unit includes: The device management function specified by the device management policy to be used set by the policy management unit may be determined as the device management function to be executed.

  According to this invention, the state setting unit sets various device states according to the detection result of the device management event, and the device management execution unit responds to various device management policies according to the device state. It is possible to perform device management.

  In the first feature of the present invention, when the event detection unit detects a first device management event when the device state is the first state, the state setting unit displays the device state. When the event detection unit detects a second device management event when the device state is the first state and the device state is the first state, the state setting unit The state may be set to a second state, and the policy management unit may set the device management policy for the second state as the device management policy to be used.

  In the first aspect of the present invention, when the device state is the first state, and the event detection unit detects the second device management event, the device management execution unit The second device management function specified by the device management policy for the second state set as the device management policy to be used may be executed.

  According to this invention, the device management execution unit can execute the device management function specified by the device management policy that matches the detected device state transition.

  In the first aspect of the present invention, when the device state is the first state, the device management execution unit sets the device for the first state set as the device management policy to be used. The policy management unit executes a first device management function specified by a management policy, and the policy management unit executes the second device according to the first device management function specified by the device management policy for the first state. The second device management function to be specified may be determined by a state device management policy.

  According to this invention, it becomes possible to perform flexible device management in consideration of both the device management function executed before the change of the device state and the change of the generated device state.

  In the first aspect of the present invention, when the device state is the first state, the event detection unit detects the second device management event and then the first state within a certain time. Only when the device management event is not detected, the state setting unit may set the device state to the second state.

  According to this invention, when the detected device management event is a battery low or a network line disconnection, such as a temporary battery decrease or a network line disconnection that is likely to occur in a device such as a mobile terminal. By ignoring device management events, it is possible to reduce the cost of device management.

  In the first feature of the present invention, the second device management function may be a function that disables a specific function in the device.

  According to this invention, for example, in a device state in which the execution of the device management function is remarkably restricted, it is possible to prevent an illegal act or a malfunction by disabling a specific function.

  In the first aspect of the present invention, the first device management function may be a function that can be used or disabled in a specific situation.

  According to this invention, for example, when the first device management function is a limiting function that enables or disables a specific function of a device depending on a specific situation. When a device state in which the device management function cannot be executed is detected and the above-described specific situation cannot be detected, the state where the first device management function is disabled in advance and the most restrictive device management is performed. Can be maintained.

  In the first feature of the present invention, the second device management function may be a function for protecting specific information in the device.

  According to this invention, for example, it is possible to prevent information leakage from the device by protecting specific information in a device state in which execution of the device management function is significantly restricted.

  In the first feature of the present invention, when the device state is the second state, the device management execution unit detects the usage when the event detection unit detects a third device management event. After executing the third device management function specified by the device management policy for the second state set as the device management policy to be performed, the state setting unit sets the device state to the first device management policy. The policy management unit may set the device management policy for the first state as the device management policy to be used.

  According to this invention, when restoring the device state by detecting the third device management event, first, the device management function according to the device management policy set at that time is executed, and then Since the device state is set to the original state, a special device management function for restoring the device state can be executed before the device state is restored.

  In the first aspect of the present invention, the third device management function can use a specific function in the device that has been disabled while the device state is the second state. It may be a function.

  According to this invention, the device management function that has been disabled due to a change in the device state can be used again.

  In the first feature of the present invention, the third device management function may be a function of restoring specific information in the device.

  According to this invention, it becomes possible to access again specific information that has become impossible to access due to a change in the device state.

  In the first aspect of the present invention, an event accumulation unit accumulates the first device management event detected by the event detection unit, and the second state is determined by the event detection unit. An event cannot be detected, and the third device management function may include at least a device management function for the first device management event stored in the event storage unit.

  In the first aspect of the present invention, the event accumulation unit accumulates the first device management event detected by the event detection unit when the device state is in the second state, and the event The detection unit detects the third device management event, the state setting unit sets the device state to the first state, and the policy management unit uses the first device management policy. When the device management policy is set, the device management execution unit may determine the device management function to be executed according to the first device management event stored in the event storage unit. Good.

  According to this invention, when a change in device state that makes it impossible to detect a device management event occurs, it occurs during the period in which the device state is stored in the event storage unit and the device state is in the second state. The device management function that is executed when the device state is restored to the first state by referring to the first device management event that has been received is the device corresponding to the first device management event that has occurred during the period Since the management function is configured to be executed, it is possible to execute the device management function that should have been performed during this period, and to restore the device state more accurately.

  In the first aspect of the present invention, the event storage unit may change a plurality of the first device management events into another first device management event.

  According to this invention, the event storage unit that stores the first device management event that has occurred during the period in which the device state is the second state understands the meaning of the stored first device management event. Since the first device management event set is converted to another first device management event having the same meaning, the first device management event stored in the event storage unit is Collectively, by converting into fewer device management events, it is possible to reduce the storage cost of the first device management event and the execution cost of the device management function when restoring the device state.

  In the first aspect of the present invention, the management status immediately before the device state transitions from the first state to the second state, and the device state transitions from the second state to the first state. The device management execution unit may execute the third device management function when there is a change between the management status immediately before the operation.

  According to this invention, when the device state transitions from the second state to the first state, the third device management function can be executed only when the management state changes during the second state. It is possible to reduce the execution cost of the device management function.

  In the first aspect of the present invention, the first state is a state capable of performing the predetermined management for the device, and the second state performs the predetermined management for the device. May not be possible.

  According to this invention, in a special device state where it is difficult to perform normal device management, it is possible to set a special device management policy and execute special device management for the device state.

  As described above, according to the present invention, when the device management can be performed properly, monitoring and preventing fraud and malfunctions can be performed, and when the device management can be performed properly, Thus, it is possible to provide a device management apparatus that enables quick restoration to the original device state.

(Configuration of device management apparatus according to the first embodiment of the present invention)
The configuration of the device management apparatus 1000 according to the first embodiment of the present invention will be described with reference to FIGS.

  The device management apparatus 1000 according to the present embodiment has a management group (for example, a mobile terminal) that is portable and can be connected to a network, such as a smart-phone, a PDA, or a notebook PC. It is an apparatus (that is, a device management apparatus) that enables an administrator or the like in a corporation to grasp the state and settings of the device and perform predetermined management (hereinafter, device management) for the device.

  Specifically, the device management apparatus 1000 according to the present embodiment is an apparatus that detects a device management event 2100 and executes the device management function 2300 according to the device management policy 2200.

  Note that the device management apparatus 1000 forcibly executes a special device management function when the state of the device or the situation surrounding the device changes and the device cannot be properly managed, It is configured to restore to the original device management state when it is restored to a state where device management can be performed properly from a state where device management cannot be performed properly by monitoring and preventing fraud and defects. ing.

  In the present embodiment, referring to FIG. 1 and FIG. 2, the device is used for the “device management” in which the company management department manages the use of the external recording medium (miniSD card or the like) 100 in the employee device 20. In the case of collecting an access log from 20 to the external recording medium 100, a description will be given of a case in which such device management cannot be performed properly depending on whether the network 300 is disconnected halfway or the DM server 10 is down. It shall be.

  Here, in the present embodiment, it is assumed that Smart-Phone is used as the device.

  An example in which the above-described device management is appropriately performed will be described with reference to FIG. In such an example, it is assumed that the company management department collects access logs from the device 20 to the external recording medium 100 by using the DM server 10 owned by the company management department for device management.

  Here, the device 20 possessed by the employee is provided with client software (that is, a DM agent) according to an instruction from the DM server, and uses the device management apparatus 100 at regular time intervals or when a specific job is executed. In addition, the DM server 10 is accessed via a monitoring function (device management function) 32 that monitors access to the external recording medium 100 and acquires a history (access log) and a network 300 (such as a cellular line or a wireless LAN). A report function (device management function) 33 for reporting a log is executed.

  Next, an example in the case where the above-described device management cannot be performed properly will be described with reference to FIG. In FIG. 2, as an example, the DM server 10 is down or the network 300 is disconnected, so that the device 20 cannot access the DM server 10, and the report function (device management function) 33 that reports the access log is appropriately used. It shows the case that can not be executed.

  In such a case, the device management apparatus 1000 prevents unauthorized processing and problems by prohibiting (locking) access to the external recording medium 100.

  Specifically, in the device 20, the device management apparatus 1000 includes a monitoring function (device management function) 32 for monitoring and collecting access logs, and a reporting function (device management function) 33 for reporting access logs. The lock function (device management function) 343 for interrupting the execution and locking the access to the external recording medium 100 is executed.

  Further, in the present embodiment, the report function (device management function) 33 for reporting the access log can be appropriately executed by the recovery of the DM server 10 or the network 300 recovery from the device state shown in FIG. In this case, the normal device management state shown in FIG. 1 (the state in which access logs are collected and reported to the external recording medium) is restored.

  Hereinafter, a configuration of the device management apparatus 1000 that realizes such a case will be described.

  As illustrated in FIG. 3, the device management apparatus 1000 includes an event detection unit 1100, a policy management unit 1200, a state setting unit 1300, and a device management execution unit 1400.

  The event detection unit 1100 is configured to detect a specific device management event.

  Specifically, the event detection unit 1100 detects that a device management event 2100 has occurred, and determines whether the detected device management event 2100 belongs to the first device management event 2110 or a second device management event. Whether it belongs to 2120 or the third device management event 2130, and in response to this determination, the state setting unit 1300 or the device management execution unit 1400 detects that the device management event 2100 has been detected. Tell.

  Here, the first device management event 2110 is a normal event that triggers activation of a general device management function. For example, an access to an external device or a non-contact IC card (such as FeliCa) Signals and notifications from timers are assumed.

  The second device management event 2120 is an event at the time of a state change that triggers a situation in which device management cannot be performed properly. For example, the network line is disconnected, the DM server is down, or the device is powered off. Etc. are assumed.

  Also, the third device management event 2130 is an event at the time of state restoration that triggers recovery to a state where device management can be performed appropriately. For example, improvement in network quality, recovery of the DM server, It is assumed that the device is powered on.

  For example, the event detection unit 1100 uses a list of device management events belonging to each device management event 2110 to 2130, so that the detected device management event 2100 becomes one of the first to third device management events 2110 to 2130. You can decide whether you belong.

  FIG. 4 shows an example of a list of device management events (first event list) belonging to the first device management event 2110. FIG. 5 shows a list of device management events (first event list) belonging to the second device management event 2120. FIG. 6 shows an example of a list of device management events (third event list) belonging to the third device management event 2130.

  For example, a notification from a timer or an interrupt from the external recording interface due to access to the external recording medium 100 is processed as a first device management event.

  Further, for example, disconnection of the network line or down of the DM server 10 is processed as the second device management event 2120.

  Further, for example, network restoration and DM server 10 restoration are processed as the third device management event 2130.

  The event detection unit 1100 can detect a network line disconnection or a network recovery by detecting an interrupt from the network interface.

  Further, the event detection unit 1100 can detect that the DM server 10 is down by a notification from the report function 33 that manages communication with the DM server 10.

  Further, the event detection unit 1100 can detect the recovery of the DM server based on the notification from the DM server 10.

  As will be described later, when the device state is the “first state (a state in which device management can be performed appropriately)”, the event detection unit 1100 performs the first device management event 2110 or the third device. When the management event 2130 is detected, this is notified to the device management execution unit 1400, and when the second device management event 2120 is detected, this is notified to the state setting unit 1300.

  Similarly, when the device state is the “second state (a state in which it is difficult to perform device management appropriately)”, the event detection unit 1100 receives the first device management event 2110 or the second When the device management event 2120 is detected, this is notified to the device management execution unit 1400, and when the third device management event 2130 is detected, this is notified to the state setting unit 1300.

  Here, the “first state” is a state in which predetermined management (device management) can be performed on the device 20, and the “second state” is a state in which it is difficult to perform device management. .

  The state setting unit 1300 is configured to set a device state in accordance with a detection result of a specific device management event by the event detection unit 1100.

  With reference to FIG. 7, how the device state set by the state setting unit 1300 transitions will be described.

  If the event detection unit 100 detects the first device management event 2110 or the third device management event 2130 when the device state is “first state”, the state setting unit 1300 The state is maintained as “first state”.

  If the event detection unit 1100 detects the second device management event 2120 when the device state is “first state (normal time)”, the state setting 1300 displays the device state as “ Change to “second state (when DM is not possible)”.

  On the other hand, when the device state is “second state” and the event detection unit 1100 detects the first device management event 2110 or the second device management event 2120, the state setting unit 1300 , The device state is kept in the “second state”.

  If the event detection unit 1100 detects the third device management event 2130 when the device state is “second state”, the state setting unit 1300 sets the device state to “first state”. Change to "Status".

  In addition, when the device state is “first state”, the event detection unit 1100 detects the first device management event 2110 within a certain time after detecting the second device management event 2120. Only when there is not, the state setting unit 1300 may be configured to set the device state to the “second state”.

  The policy management unit 1200 includes a device state set by the state setting unit 1300 and a detection result of a specific device management event by the event detection unit 1100 among a plurality of device management policies 2200 that specify a device management function. Accordingly, the device management policy to be used is set.

  The policy management unit 1200 notifies the device management execution unit 1400 of the device management policy selected as the device management policy to be used.

  When the device state is “first state”, the policy management unit 1200 sets (selects) the first device management policy 2210 as the device management policy to be used, and the device state is “second state”. In the case of “the state of”, the policy management unit 1200 sets (selects) the second device management policy 2220 as the device management policy to be used.

  For example, when the device state is “first state” and the event detection unit 1110 detects the second device management event 2120, the state setting unit 1130 sets the device state to “second state”. The policy management unit 1200 sets the device management policy for the second state (second device management policy) as the device management policy to be used.

  Here, the device management policy 2200 specifies a device management function to be executed by the device management execution unit 1400.

  Specifically, the first device management policy 2210 instructs to execute the first device management function 2310 when the first device management event 2110 or the third device management event 2130 is detected. It is.

  On the other hand, when the second device management policy 2220 detects the first device management event 2110 or the second device management event 2120, the second device management policy 2220 executes the second device management function 2320 and performs the third device management event 2130. Is detected, the third device management function 2330 is instructed to be executed.

  The policy management unit 1200 may be configured to download the device management policy 2200 from the DM server 10 or the like, or by copying the device management policy 2200 from a smart card or the like distributed by the company management department. The device management policy 2200 that is stored in advance when the device 20 is shipped may be used.

  The device management execution unit 1400 is configured to perform predetermined management (device management) on the device 20 by executing a device management function 2300 provided in the device 20.

  Specifically, the device management execution unit 1400 performs a device management function to be executed according to the detection result of the specific device management event 2100 by the event detection unit 1100 and the device state set by the state setting unit 1300. 2300 is configured to be determined.

  More specifically, the device management execution unit 1400 determines the device management function 2300 specified by the “device management policy 2200 to be used” set by the policy management unit 1200 as the device management function 2300 to be executed. It is configured.

  The device management execution unit 1400 is a device specified by the “device management policy 2200 to be used” set by the policy management unit 1200 according to the detection result of the specific device management event 2100 by the event detection unit 1100. The management function 2300 may be configured to determine the device management function 2300 to be executed.

  For example, when the device state is “second state” and the first device management event 2110 or the second device management event 2120 is detected, the device management execution unit 1400 detects the second device management policy. The second device management function 2320 specified by 2220 is configured to be executed.

  In addition, when the device state is “second state” and the third device management event 2130 is detected, the device management execution unit 1400 identifies the third device specified by the second device management policy 2220. The device management function 2330 is configured to be executed.

  In this embodiment, the device management execution unit 1400 monitors the access to the external recording medium 100 and collects access logs by executing the monitoring function 32 as the first device management function 2310 (normal time). At the same time, by executing the report function 33, the access log to the DM server 10 is reported.

  The device management execution unit 1400 also locks the access function (specific function) to the external recording medium 100 by executing the lock function 31 as the second device management function 2320 (when the state changes). Impossible).

  Further, the device management execution unit 1400 executes the lock function 31 as the third device management function 2330 (during state restoration), thereby unlocking the access function to the external recording medium 100 (external recording medium 100). To enable access to).

  Note that, as in the present embodiment, the device management execution unit 1400 executes the second device management function 2320 to lock the access function to the external recording medium 100, as well as corporate confidential documents. In order to prevent leakage, the second device management function (function for protecting specific information in the device 20) 2320 is executed to encrypt the confidential document, and the third device management function (specification in the device 20). A function of decrypting the encrypted confidential document by executing 2330 is also conceivable.

  In such a case, for example, the second device management function 2320 uses an algorithm such as 3DES or RSA to process the entire document (or a designated portion) to which a flag indicating that the document is a confidential document is assigned in advance. It is good also as a function to encrypt.

  At this time, the third device management function 2330 is a function for decrypting a specific document based on a list describing the encrypted document.

  In addition, the second device management function 2320 uses a file system as a function that makes an access attribute “impossible” to a confidential document (a function that protects specific information), and the third device management function 2330 uses an access A function for returning the attribute to “permitted” (a function for restoring specific information) may be used.

  In such a case, the second device management function 2320 stores the access attribute of the confidential document before the device state becomes the “second state”, and then sets the access attribute of the confidential document to “impossible”. Then, the third device management function acquires an appropriate access attribute of the stored confidential document and restores the access attribute to the original.

  If the event detection unit 1110 detects the first device management event 2110 or the third device management event 2130 when the device state is “first state”, the device management execution unit 1400 The first device management function 2310 specified by the device management policy (first device management policy) 2210 for the first state set as the device management policy to be used is executed.

  If the event detection unit 1110 detects the second device management event 2120 when the device state is “first state”, the device management execution unit 1400 sets the device management policy to be used. The second device management function 2320 specified by the second device management policy for the second state (second device management policy) 2220 is executed.

(Operation of the device management apparatus according to the first embodiment of the present invention)
The operation of the device management apparatus 1000 according to the first embodiment of the present invention will be described with reference to FIGS.

  First, with reference to FIG. 8, the operation of the event detection unit 1100 in the device management apparatus 1000 according to the present embodiment will be described.

  As shown in FIG. 8, in step S1001, the event detection unit 1100 first reads an event list for distributing to which of the first to third device management events each device management event 2100 belongs.

  Here, the event list includes a second event list that lists the second device management events and a third event list that lists the third device management events.

  In step S1002, the event detection unit 1100 acquires the current device state.

  In steps S1003 to S1005 (event waiting loop), the event detection unit 1100 waits for the device management event to arrive until the device management ends.

  When detecting that a device management event has arrived, the event detection unit 1110 checks whether or not the current device state is “first state” in step S1006.

  When it is determined that the current device state is the “first state”, the event detection unit 1110 uses the second event list in steps S1011 to S1013 and detects it in the second event list. Check whether a device management event exists.

  If the event detection unit 1110 determines that such a device management event exists in the second event list, the event detection unit 1110 notifies the state setting unit 1300 that the device management event has arrived in step S1014, and returns to step S1005. .

  On the other hand, when the event detection unit 1110 determines that the device management event does not exist in the second event list, the event detection unit 1110 notifies the device management execution unit 1400 that the device management event has arrived in step S1031, and step S1005. Return to.

  On the other hand, when it is determined in step S1006 that the current device state is not the “first state” (that is, the “second state”), the event detection unit 1110 includes the third device state in steps S1021 to S1023. The event list is used to check whether a detected device management event exists in the third event list.

  If the event detection unit 1110 determines that such a device management event exists in the third event list, in step S1024, the event detection unit 1110 notifies the state setting unit 1300 that the device management event has arrived, and returns to step S1005. .

  On the other hand, when determining that the device management event does not exist in the third event list, the event detection unit 1110 notifies the device management execution unit 1400 that the device management event has arrived in step S1031, and step S1005. Return to.

  Here, when detecting the end of device management in the event waiting loop, the event detection unit 1110 ends its operation.

  Note that if the second device management event is detected in step S1012, the event detection unit 1110 may perform the process of step S1014 if the third device management event is not detected within a predetermined time.

  As a result, the processing efficiency of the entire device management apparatus 1000 is improved. For example, when the device 20 is passing through a tunnel, the network quality is deteriorated for only a few seconds, and the network quality is immediately improved, so that the device state is shifted to the “second state”. If the “first state” is left as it is, the processing does not become redundant.

  Secondly, with reference to FIG. 9, the operation of the state setting unit 1300 in the device management apparatus 1000 according to the present embodiment will be described.

  As illustrated in FIG. 9, in step S1101, the state setting unit 1300 acquires the current device state. In the initial state, the device state is assumed to be “first state”.

  In steps S1102 to S1104 (input waiting loop), the state setting unit 1300 waits for a notification from the event detection unit 1100.

  When the state setting unit 1300 detects the notification from the event detection unit 1100, in step S1105, the state setting unit 1300 checks whether or not the current device state is the “first state”.

  If the current device state is “first state”, in step S1106, the state setting unit 1300 sets the device state to “second state”.

  On the other hand, if the current device state is the “second state”, in step S1107, the state setting unit 1300 sets the device state to the “first state”.

  In step S1108, the state setting unit 1300 notifies the event detection unit 1100 and the policy management unit 1200 of the device state set in step S1106 or S1107, and then returns to step S1104.

  Here, when the end of device management is detected in the input waiting loop, the state setting unit 1300 ends the operation.

  Third, the operation of the policy management unit 1200 in the device management apparatus 1000 according to the present embodiment will be described with reference to FIG.

  As shown in FIG. 10, in steps S1201 to S1203 (policy change loop), the policy management unit 1200 waits for a notification from the state setting unit 1300.

  If the policy management unit 1200 detects a notification from the state setting unit 1300, the policy management unit 1200 reads the current device state in step S1204, and determines whether or not the current device state is “first state” in step S1205. To check.

  If the current device state is “first state”, the policy management unit 1200 selects (sets) the first device management policy as the device management policy to be used in step S1208.

  On the other hand, if the device state is “second state”, the policy management unit 1200 selects (sets) the second device management policy as the device management policy to be used in step S1206.

  In step S1207, the policy management unit 1200 notifies the device management execution unit 1400 of the device management policy selected (set) in step S1206 or S1208, and then returns to step S1203.

  If the policy management unit 1200 detects the end of device management in the policy change loop, the policy management unit 1200 ends the process.

  Fourth, the operation of the device management execution unit 1400 in the device management apparatus 1000 according to the present embodiment will be described with reference to FIG.

  As shown in FIG. 11, in step S1301, the device management execution unit 1400 displays a device management policy selected by the policy management unit 1200 (that is, a device set as a device management policy to be used by the policy management unit 1200). Management policy).

  Here, the device management policy includes a first device management policy 2210 to be used in a normal state (that is, in the first state), and a state in which device management cannot be performed appropriately (that is, the second device management policy). There is a second device management policy to use (in the state).

  In step S1301, the device management execution unit 1400 acquires the first device management policy 2210 that is in the initial state.

  In steps S1302 to S1305 (event wait loop), the device management execution unit 1400 waits for a notification from the policy management unit 1200 or the event detection unit 1100.

  If the device management execution unit 1400 detects a notification from the policy management unit 1200 in step S1303, the device management execution unit 1400 acquires the corresponding device management policy in accordance with the notification in step S1311, and then returns to step S1304.

  If the device management execution unit 1400 detects a notification from the event detection unit 1100 in step S1304, the device management execution unit 1400 selects a device management function to be executed in response to the notification from the event detection unit 1100 in step S1306. In step S1307, after the selected device management function is executed, the process returns to step S1305.

  If the device management execution unit 1400 detects the end of device management in the event waiting loop, the device management execution unit 1400 ends the processing.

  Fifth, the overall operation of the device management apparatus 1000 according to the present embodiment will be described with reference to the examples shown in FIGS. It is assumed that the initial state of the device state is the “first state”.

  In step A1, when the event detection unit 1100 detects that a predetermined time has arrived (notification from the timer), the event detection unit 1100 understands that the first device management event 2110 has occurred, and sends it to the device management execution unit 1400. It notifies the fact that the first device management event has been detected.

  In step A2, the device management execution unit 1400 accesses the external recording medium 100 for a certain period of time as the first device management function 2310 in accordance with the first device management policy 2210 set in advance by the policy management unit 1200. A monitoring function 32 that monitors and collects the access log and a report function 33 that reports the access log to the DM server 10 are executed.

  In step A3, when the predetermined time is over, the device management execution unit 1400 stops the execution of the first device management function 2310 (the monitoring function 32 and the reporting function 33).

  In step A4, when the event detection unit 1100 detects that the network line disconnection has occurred, the event detection unit 1100 understands that the second device management event 2120 has occurred, and notifies the state setting unit 1300 to the second device management event. Notify that it has been detected.

  In step A5, the state setting unit 1300 sets the device state to “second state” and notifies the event detection unit 1100 and the policy management unit 1200 to that effect.

  In step A6, the policy management unit 1200 selects the second device management policy 2220 as the device management policy to be used, and notifies the device management execution unit 1400 to that effect.

  Thereafter, each time the event detection unit 1100 notifies the device management execution unit 1400 that the first device management event 2110 and the second device management event 2120 have been detected, the device management execution unit 1400 In accordance with the device management policy 2220, a lock function 31 that locks access to the external recording medium 100 is executed as the second device management function 2320.

  In step A7, when the event detection unit 1100 detects that the network has been restored, the event detection unit 1100 understands that the third device management event 2130 has been detected, and the state setting unit 1300 and the device management execution unit 1400 3 that the device management event 2130 is detected.

  Here, since it is possible to attempt to access the network from the device 20, it is possible to detect the restoration of the cellular line or the wireless LAN network.

  In step A <b> 8, the device management execution unit 1400 executes the lock function 31 that unlocks the access to the external recording medium 100 as the third device management function 2330 according to the second device management policy 2220.

  In step A9, the state setting unit 1300 sets the device state to “first state” and notifies the event detection unit 1100 and the policy management unit 1200 to that effect.

  In step A10, the policy management unit 1200 selects (sets) the first device management policy 2210 as a device management policy to be used, and notifies the device management execution unit 1400 to that effect.

  Thereafter, whenever the event detection unit 1100 notifies the device management execution unit 11400 that the first device management event 2110 and the third device management event 2130 have been detected, the device management execution unit 1400 should use them. The first device management function is executed in accordance with the first device management policy set as the device management policy.

  As described above, when the event detection unit 1100 detects the third device management event 2130 when the device state is the “second state”, the device management execution unit 1400 uses the device management to be used. After executing the third device management function 2330 specified by the device management policy for the second state (second device management policy) 2220 set as the policy, the state setting unit 1300 displays the device state. The policy management unit 1200 is configured to set the device management policy for the first state (first device management policy) 2210 as the device management policy to be used. Yes.

(Operations and effects of the device management apparatus according to the first embodiment of the present invention)
According to the device management apparatus 1000 according to the first embodiment of the present invention, the state setting unit 1300 detects the device management event 2100 (first to third device management events 2110 to 2130) detected by the event detection unit 1100. Depending on the device state, the device management execution unit 1400 sets various device states (first state or second state), and the device management execution unit 1400 performs device management (DM according to the various device management policies 2200 according to the device state. Remote monitoring using an agent).

  According to the device management apparatus 1000 according to the first embodiment of the present invention, the device management function 2300 (first to second) executed before the change of the device state (first state or second state) is performed. Device management functions 2310 to 2330) and flexible device management can be performed in consideration of both changes in the generated device state (first state or second state).

  According to the device management apparatus 1000 according to the first embodiment of the present invention, the device management execution unit 1400 uses the device management function 2300 (first view) specified by the device management policy 2200 that matches the detected device state transition. To the second device management function 2310 to 2330).

  According to the device management apparatus 1000 according to the first embodiment of the present invention, the detected device management event 2100 occurs in the device 20 such as a mobile terminal when the detected battery management event 2100 is a battery low or a network line disconnection. It is possible to ignore the device management event 2100 such as temporary battery decrease and network line disconnection that tend to occur, and to reduce the cost for device management.

  According to the device management apparatus 1000 according to the first embodiment of the present invention, for example, by protecting specific information (for example, confidential documents) in a device state in which the execution of the device management function is significantly restricted. It becomes possible to prevent information leakage from the device 20.

  According to the device management apparatus 1000 according to the first embodiment of the present invention, when the device state is restored from the second state to the first state by detecting the third device management event 2130, first, Since the third device management function 2330 according to the second device policy 2220 set at that time is executed and then the device state is set to the original state, the device state is restored to the original state. Before returning to, a special device management function (such as a function for enabling the access function to the external recording medium 100 or a function for decrypting a confidential document) for restoring the device state to the first state is executed. It becomes possible.

  According to the device management apparatus 1000 according to the first embodiment of the present invention, it is possible to access again specific information (for example, confidential information) that has become impossible to access due to a change in the device state. It becomes possible.

  The device management apparatus 1000 according to the first embodiment of the present invention sets a special device management policy 2300 in a special device state (second state) in which it is difficult to perform normal device management, This makes it possible to execute special device management for the device state.

  According to the device management apparatus 1000 according to the first embodiment of the present invention, for example, in a device state (second state) in which the execution of the device management function 2300 is significantly restricted, a specific function (for example, external By making the recording medium access function unusable, it is possible to prevent fraud and malfunctions.

(Device management apparatus according to the second embodiment)
A device management apparatus 1000 according to the second embodiment of the present invention will be described with reference to FIGS. Hereinafter, the device management apparatus 1000 according to the second embodiment of the present invention will be described focusing on differences from the device management apparatus 1000 according to the first embodiment described above.

  The configuration of the device management apparatus 1000 according to the present embodiment is the same as the configuration of the device management apparatus 1000 according to the first embodiment. However, as shown in FIG. A feature is that an event storage unit 2400 is provided inside or outside the device.

  The event accumulation unit 2400 is configured to accumulate the first device management event 2110 detected by the event detection unit 1100 when the device state is “second state”.

  The first device management event 2110 stored in the event storage unit 2400 is used when the device state of the device management apparatus 1000 is correctly restored from the “second state” to the “first state”.

  In the present embodiment, as shown in FIGS. 13 and 14, a scenario in which the device 20 includes a non-contact IC card 400 and an employee uses each office system by using the non-contact IC card 400. Is assumed.

  Specifically, the non-contact IC card 400 according to the present embodiment includes an entrance / exit function 410 for managing entrance / exit to / from an office and a log-in function 420 for a PC.

  It is assumed that the entrance / exit function 410 and the login function 420 work when an employee holds the non-contact IC card 400 over the reader 400A (for example, a FeliCa reader).

  That is, the employee can enter the office by holding the non-contact IC card 400 over the reader 400A prepared at the entrance of the office, and the non-contact IC card 400 is placed in the reader 400A prepared at the office exit. You can leave the office by holding it over.

  Further, the employee can log in to the PC by holding the non-contact IC card 400 over the reader 400A provided in the PC.

  Furthermore, the entrance / exit function 410 and the login function 420 are linked to each other according to the following rules.

-When an employee enters the office, the PC login function 420 is enabled (can be used).

-When an employee leaves the office, basically, the PC login function 420 is disabled (unusable).

-Only when the use of the PC outside the office is permitted, the login function 420 to the PC via the server becomes effective even after the employee leaves the office.

The validation / invalidation of the login function of the non-contact IC card as described above is performed via the DM server 10.

  Here, as described above, the login function 420 becomes usable or unusable depending on the user's office entry / exit situation (specific situation), for example, whether or not the user can log in to the PC. It serves as a first device management function to be determined.

  A system for realizing device management (entrance / exit management and login management) using the device management apparatus 1000 according to the present embodiment will be described with reference to FIGS.

  Specifically, the system includes an entry / exit function 410, a login function 420, a device management apparatus 1000, an event notification function 34 for notifying the DM server 10 of an entry / exit event, and the notification. Accordingly, the DM server 10 that enables (uses) or disables (cannot use) the login function 420 is provided.

  When the contactless IC card 400 is held over the reader 400A when the employee enters the office, the device management apparatus 1000 detects an entry event via the entry / exit function 410.

  The device management apparatus 1000 activates (executes) the event notification function 34 in accordance with the detection of the room entry event, and notifies the DM server 10 of the detected room entry event. The DM server 10 enables the login function 420 and enables login to the PC in the office.

  Further, when the contactless IC card 400 is held over the reader 400A when the employee leaves the office, the exit event is notified to the DM server 10 as in the case of entering the room.

  The DM server 10 determines whether or not the employee who is the user of the device is permitted to use the PC outside the office. If the employee is permitted, the DM server 10 validates the login function 410.

  If the above-described processing is performed normally, a non-authorized user should not be able to use the PC outside the office. However, as described above, device management may not be performed properly.

  As an example of such a case, the situation shown in FIG. 14 is assumed. In such an example, it is assumed that the DM agent 30 itself cannot detect an entry / exit event due to a device power-off or the like.

  In general, the non-contact IC card 400 provided in the device 20 such as a mobile terminal can operate with weak power, so that the power of the device 20 is turned off. In addition, the entrance / exit function 410 and the login function 420 provided in the non-contact IC card 400 can be used.

  However, in such a state, since the DM agent 30 that is software on the device 20 does not operate, the event detection function 34 for notifying the DM server 10 of an entrance / exit event cannot operate.

  Accordingly, when the user turns off the device 20 while entering the office, the user can leave the office without the login function 420 being disabled.

  In order to prevent such a situation, for example, when the power source of the device 20 is disconnected by long-pressing a power button provided in the device 20, the device management apparatus 1000 causes the power source of the device 20 to A disconnection event is detected, the event detection function 34 is used to notify the DM server 10 of the fact, and the login function 420 is invalidated by the DM server 10.

  As a result, even when the user leaves the office with the device 20 turned off, the login function 420 is not validated and the PC cannot be used outside the office.

  Here, the case where the power source of the device 20 is turned off by removing the battery is not taken into consideration. Although it is difficult for the device management apparatus 1000 to detect such an event, the contactless IC card 400 itself does not operate in the absence of a battery, so entry / exit or login itself becomes impossible, and the outside of the office There is no concern that the PC will be used illegally.

  Furthermore, as described above, consider the case where the login function 420 is forcibly disabled and the power of the device 20 is turned off after the power of the device 20 is turned off.

  In such a case, it is necessary to enable the login function 420 if the user is permitted to use the PC regardless of whether the user is in the office or outside the office.

  Further, when the user is outside the office and the use of the PC is not permitted, the login function 420 needs to be disabled.

  As described above, in order to realize restoration to a normal state, in this embodiment, an entry / exit event that occurs inside the device 20 or outside the device 20 while the power of the device 20 is turned off. It is assumed that an event storage unit 2400 is provided for detecting and storing.

  For example, the entrance / exit function 420 can include the event storage unit 2400. As described above, since the contactless IC card 400 and the entrance / exit function 420 can be operated even while the power of the device 20 is turned off, the event storage unit 2400 is provided in the entrance / exit function 420. If it is, the entrance / exit event which occurred while the device 20 was turned off can be accumulated.

  However, in this embodiment, since it is clear that the user is either in the office or has left the office, the event storage unit 2400 has once stored the exit event. In some cases, it is possible to discard a previously stored entry event.

  Similarly, when the event storage unit 2400 has once stored an entry / exit event, it can discard the exit event stored before that.

  When the device 20 is turned on again, the device management apparatus 1000 detects that fact and executes the event notification function 34 based on the entry / exit event stored in the event storage unit 2400. Thus, the device 20 can be restored to a normal state.

  Here, FIGS. 15 to 17 exemplify lists of first to third device management events detected by the event detection unit 1100 according to the present embodiment.

  FIG. 15 shows an example of a list of device management events (first event list) belonging to the first device management event 2110, and FIG. 16 shows a list of device management events (first event list) belonging to the second device management event 2120. FIG. 17 shows an example of a list of device management events (third event list) belonging to the third device management event 2130.

  In the present embodiment, when a device management event (device power-off) “ID = 0” in the second event list occurs, the state setting unit 1300 shifts the device state to the “second state”. Then, when a device management event (device power recovery) of “ID = 0” occurs in the third event list, the state setting unit 1300 restores the device state to the “first state”.

  Here, in the present embodiment, the “first state” is a state in which the device 20 is operating normally, and the “second state” is a state in which the device 20 is powered off (event detection unit). 1100, the device management event 2100 cannot be detected).

  In the present embodiment, the “first device management event 2110” is an entrance / exit event, and the “second device management event 2120” is an event in which the power button is pressed and held to turn off the power. , “Third device management event 2130” is the power-on of the device.

  Furthermore, in the present embodiment, the “first device management function 2310” is a notification of an entrance / exit event to the DM server 10, and the “second device management function 2320” is a power-off of the device 20 to the DM server 10. The “third device management function 2330” is a notification to the DM server 10 of the entrance / exit event stored in the event storage unit 2400.

  In addition, the “first device management policy 2210” specifies that the DM server 10 is notified when an entry / exit event is detected by the device, and the “second device management policy 2220” That the DM server 10 is notified of the power-off and the DM server 10 is notified of the entrance / exit events accumulated during the power-off of the device 20.

  It is possible to realize the system according to the present embodiment by performing the replacement as described above and the device management apparatus 1000 performing an operation equivalent to that of the first embodiment.

  Here, in the present embodiment, the event accumulation unit 2400 may be configured to collectively change a plurality of first device management events 2110 to another first device management event 2110.

  For example, when the event storage unit 2400 stores “entrance event + exit event + entrance event” as a plurality of first device management events 2110, the first device management event 2110 is collectively referred to as “entrance event”. May be stored as "."

  According to the device management apparatus 1000 according to the second embodiment of the present invention, for example, the first device management function 2310 can be used in accordance with a specific situation (a user's office entry / exit situation). In the case of a restriction function (login function) that cannot be used, the device state (second state) in which the first device management function 2310 cannot be executed is entered, and the above-mentioned specific situation (user The first device management function 2310 (login function) can be disabled in advance and the most restrictive device management state can be maintained when the office entry / exit status) cannot be detected. Become.

  According to the device management apparatus 1000 according to the second embodiment of the present invention, the event storage unit 2400 that stores the first device management event 2110 that has occurred during the period in which the device state is the second state is stored. Understand the meaning of the first device management event 2110 being performed, and the first device management event 2110 set (“entry event + leaving event + entry event”) is another first device having the same meaning. Since it is configured so as to be converted into a management event 2110 (“entrance event”), the first device management events 2110 accumulated in the event accumulation unit 2400 are collected into the fewer first device management events 2110. The storage cost of the first device management event 2110 and the device state It is possible to reduce the execution cost of the device management function 2300 during restoration.

(Device management apparatus according to the third embodiment)
A device management apparatus 1000 according to the third embodiment of the present invention will be described with reference to FIGS. Hereinafter, the device management apparatus 1000 according to the third embodiment of the present invention will be described by focusing on differences from the device management apparatus 1000 according to the first or second embodiment described above.

  In the present embodiment, a case is considered in which, in the second embodiment, the “second state” is a state in which the device 20 is not powered off and the DM server 10 is down.

  The difference between the present embodiment and the second embodiment is that the device management apparatus 1000 includes an event accumulation unit 1110 that accumulates entry / exit events that occur while the DM server 10 is down.

  With reference to FIG. 19, an operation when the DM server 10 is down and returned will be described.

  While the DM server 10 is down, both the device management apparatus 1000 and the non-contact IC card 400 operate normally. However, since the DM server 10 is down, even if an entry / exit event occurs, the device management apparatus 1000 cannot notify the DM server 10 of the entry / exit event by executing the event notification function 34.

  In such a case, since the login function 420 cannot be disabled when the employee (user) leaves the office, as in the case of the second embodiment, the employee is in the office. However, it is necessary to prevent the unauthorized use of the PC outside the office by disabling the login function 420. However, when the DM server 10 is down, it is impossible to perform such processing.

  Therefore, when the DM server 10 is down, the device management apparatus 1000 can disable the login function 420 by activating the device invalidation function 35 and invalidating the non-contact IC card 400 itself.

  For example, the login function 420 can be disabled by prohibiting the use of the non-contact IC card 400 by setting the device 20 or deleting the corresponding device driver from the OS.

  In addition, the event storage unit 1110 in the device management apparatus 1000 stores the room entry / exit events that occur while the DM server 10 is down, and the DM server 10 is restored and can execute the device management function 2300. The device management function 2300 is executed to restore a normal device state.

  Here, FIGS. 15 to 17 exemplify lists of first to third device management events detected by the event detection unit 1100 according to the present embodiment.

  FIG. 15 shows an example of a list of device management events (first event list) belonging to the first device management event 2110, and FIG. 16 shows a list of device management events (first event list) belonging to the second device management event 2120. FIG. 17 shows an example of a list of device management events (third event list) belonging to the third device management event 2130.

  In the present embodiment, when a device management event (DM server down) of “ID = 1” in the second event list occurs, the state setting unit 1300 shifts the device state to “second state”. Then, when a device management event (DM server recovery) of “ID = 1” in the third event list occurs, the state setting unit 1300 restores the device state to the “first state”.

  Here, in the present embodiment, the “first state” is a state in which the device 20 is operating normally, and the “second state” is a state in which the DM server 20 is down.

  In the present embodiment, the “first device management event 2110” is an entrance / exit event, and the “second device management event 2120” is an event for notifying that the DM server 10 has gone down. The “third device management event 2130” is an event for notifying that the DM server 10 has been restored.

  Such notification is realized by, for example, a push function by SMS (Short Message Service).

  Further, the “first device management function 2310” is a notification of an entrance / exit event to the DM server 10, and the “second device management function 2320” is a notification of power-off of the device 20 to the DM server 10, The “third device management function 2330” is a notification to the DM server 10 of an entrance / exit event stored in the event storage unit 2400.

  As described above, the “third device management function 2330” includes at least a device management function for the entry / exit event (first device management event) 2110 stored in the event storage unit 2400.

  Specifically, the “third device management function 2330” indicates that the entry / exit event stored in the event storage unit 2400 as the first device management event in the “second state” is the “first state”. "Device management function for the first device management event" that notifies (uploads) to the DM server after the recovery.

  Further, in the present embodiment, the “first device management function 2310” is a notification of an entrance / exit event to the DM server 10, and the “second device management function 2320” is a non-contact by the device invalidation function 35. The IC card 400 is invalidated, and the “third device management function 2330” is a notification to the DM server 10 of an entrance / exit event stored in the event storage unit 1110 by the event notification function 34.

  In addition, the “first device management policy 2210” stipulates that the DM server 10 is notified of this when a device entry / exit event is detected, and the “second device management policy 2220” The notification to the DM server 10 of the entrance / exit event stored in the event storage unit 1110 during the 10 down is defined.

  Here, the device invalidation function 35 plays a role as a second device management function that disables specific functions (the login function 420 and the entrance / exit function 410) in the device 20.

  Further, the device invalidation function 35 makes it possible to use specific functions (the login function 420 and the entrance / exit function 410) in the device 20 that have been disabled while the device state is the “second state”. It plays a role as a third device management function.

  Next, the operation of the event detection unit 1100 in the device management apparatus 1000 according to the present embodiment will be described with reference to FIG. In the present embodiment, the event detection unit 1100 includes an event storage unit 1110 as a subset.

  The operation of the event detection unit 1100 in this embodiment is different from the operation of the event detection unit 1100 in the first embodiment shown in FIG. 8 in steps S1423 and S1426.

  In step S <b> 1423, the event detection unit 1100 stores, in the event storage unit 1110, device management events that are determined not to be listed in the third event list while the device state is in the “second state”.

  In step S1426, the event detection unit 1100 notifies the device management execution unit 1400 of the device management event stored in the event storage unit 1110, and causes the device management execution unit 1400 to execute the device management event.

  As a result, the event detection unit 1100 detects an entry / exit event that is a device management event (that is, the first device management event 2110) that does not belong to the third device management event 2130 detected while the DM server 10 is down. It can be stored in the event storage unit 1110.

  As described above, by enabling or disabling the device management function according to the device management event stored in the event storage unit 1110 (that is, by determining the device management function to be executed), the device 20 can be restored to the correct state.

  If no device management event 2100 has been accumulated, the device state may be simply restored to the state before the transition to the “second state”.

  In the above example, if the login function 420 is valid before the device state shifts to the “second state”, the login function 420 may be validated.

  As described above, in this embodiment, the event detection unit 1100 detects the third device management event 2130, the state setting unit 1300 sets the device state to “first state”, and the policy management unit 1200. However, when the first device management policy 2110 is set as the device management policy to be used, the device management execution unit 1400 displays the first device management event 2110 (“entrance event” stored in the event storage unit 2400. The device management function 2300 to be executed may be determined in response to “exit event + exit event”).

  That is, the policy management unit 1200 uses the device management policy for the second state in accordance with the first device management function 2310 specified by the device management policy for the first state (first device management policy 2110). The second device management function to be specified is determined by (second device management policy 2120).

  Also, another method for realizing the event storage unit will be described.

  Hereinafter, such an event storage unit is referred to as a management status storage unit 1120 in distinction from the event storage unit 1110 described above.

  As described above, the management status storage unit 1120 is effective when the first device management event 2110 has only two types (entrance or exit).

  The management status accumulation unit 1120 accumulates the management status immediately before the device status transitions from the “first status” to the “second status” as the “first management status”. As described above, the management status immediately before the device state transitions from the “second state” to the “first state” is stored.

  When there is a change between the “first management status” and the “second management status”, the device management execution unit 1400 executes the third device management function 2330.

  In other words, if the “first management status” represents the employee entering the office and the “second management status” represents the employee leaving the office, the login function 420 is disabled. That's fine.

  Also, if the “first management status” represents the employee leaving the office and the “second management status” represents the employee entering the office, the login function 420 is activated. That's fine.

  According to the device management apparatus 1000 according to the third embodiment of the present invention, a change in device state (change from the first state to the second state) that makes it impossible to detect the device management event 2100 occurs. When it occurs, the device state is changed to the first state by referring to the first device management event 2110 that has occurred during the period in which the device state accumulated by the event accumulation unit 1110 is the second state. The device management function 2300 executed at the time of restoration executes (enables or disables) the device management function 2300 corresponding to the first device management event 2110 (entrance / exit event) that has occurred during the period. Therefore, it is possible to execute the device management function (login function) that should have been performed during this period. It is possible to restore the device status.

  According to the device management apparatus 1000 according to the third embodiment of the present invention, when the device state transitions from the second state to the first state, only when the management state changes during the second state, The third device management function 2330 can be executed, and the execution cost of the device management function can be reduced.

  Although the present invention has been described in detail using the above-described embodiments, it is obvious to those skilled in the art that the present invention is not limited to the embodiments described in this specification. The present invention can be implemented as modified and changed modes without departing from the spirit and scope of the present invention defined by the description of the scope of claims. Accordingly, the description of the present specification is for illustrative purposes and does not have any limiting meaning to the present invention.

It is a figure for demonstrating the remote monitoring using DM agent which comprises the device management apparatus which concerns on the 1st Embodiment of this invention. It is a figure for demonstrating the remote monitoring using DM agent which comprises the device management apparatus which concerns on the 1st Embodiment of this invention. It is a functional block diagram of a device management device concerning a 1st embodiment of the present invention. It is a figure which shows an example of the list | wrist of the 1st device management event used with the device management apparatus which concerns on the 1st Embodiment of this invention. It is a figure which shows an example of the list | wrist of the 2nd device management event used with the device management apparatus which concerns on the 1st Embodiment of this invention. It is a figure which shows an example of the list | wrist of the 3rd device management event used with the device management apparatus which concerns on the 1st Embodiment of this invention. It is a device state transition diagram managed by the state setting unit in the device management apparatus according to the first embodiment of the present invention. It is a flowchart which shows operation | movement of the event detection part in the device management apparatus which concerns on the 1st Embodiment of this invention. It is a flowchart which shows operation | movement of the state setting part in the device management apparatus which concerns on the 1st Embodiment of this invention. It is a flowchart which shows operation | movement of the policy management part in the device management apparatus which concerns on the 1st Embodiment of this invention. It is a flowchart which shows operation | movement of the device management execution part in the device management apparatus which concerns on the 1st Embodiment of this invention. It is a figure for demonstrating entrance / exit management using DM agent which comprises the device management apparatus which concerns on the 2nd Embodiment of this invention. It is a figure for demonstrating entrance / exit management using DM agent which comprises the device management apparatus which concerns on the 2nd Embodiment of this invention. It is a functional block diagram of the device management apparatus which concerns on the 2nd Embodiment of this invention. It is a figure which shows an example of the list | wrist of the 1st device management event used with the device management apparatus which concerns on the 2nd Embodiment of this invention. It is a figure which shows an example of the list | wrist of the 2nd device management event used with the device management apparatus which concerns on the 3rd Embodiment of this invention. It is a figure which shows an example of the list | wrist of the 3rd device management event used with the device management apparatus which concerns on the 4th Embodiment of this invention. It is a functional block diagram of the device management apparatus which concerns on the 3rd Embodiment of this invention. It is a figure for demonstrating entrance / exit management using DM agent which comprises the device management apparatus which concerns on the 3rd Embodiment of this invention. It is a flowchart which shows operation | movement of the event detection part in the device management apparatus which concerns on the 3rd Embodiment of this invention.

Explanation of symbols

1000 ... Device management apparatus 1100 ... Event detection unit 1200 ... Policy management unit 1300 ... Status setting unit 1400 ... Device management execution unit 10 ... DM server 20 ... Device 30 ... DM agent 31 ... Lock function 32 ... Monitoring function 33 ... Reporting function 100 ... External recording device 300 ... Network 2400 ... Event storage unit

Claims (17)

A device management execution unit that performs predetermined management for the device by executing a device management function provided in the device;
An event detection unit for detecting a specific device management event,
The device management execution unit determines the device management function to be executed according to a detection result of the specific device management event and a device state. A state setting unit for setting the device state according to a detection result of the specific device management event;
A device management policy to be used according to the device status set by the status setting unit and the detection result of the specific device management event from among a plurality of device management policies that specify the device management function And a policy management unit for setting
The device management execution unit determines, as the device management function to be executed, a device management function specified by the device management policy to be used set by the policy management unit. The device management apparatus described in 1. If the event detection unit detects a first device management event when the device state is the first state, the state setting unit holds the device state in the first state. ,
When the device state is the first state and the event detection unit detects a second device management event, the state setting unit sets the device state to the second state, The device management apparatus according to claim 2, wherein the policy management unit sets the device management policy for the second state as the device management policy to be used.   If the event detection unit detects the second device management event when the device state is the first state, the device management execution unit is set as the device management policy to be used. The device management apparatus according to claim 3, wherein a second device management function specified by the device management policy for the second state is executed. When the device state is the first state, the device management execution unit specifies the first state specified by the device management policy for the first state set as the device management policy to be used. Perform device management functions,
The policy management unit is configured to specify the second device management to be specified by the device management policy for the second state in accordance with the first device management function specified by the device management policy for the first state. The device management apparatus according to claim 4, wherein a function is determined.   When the device state is the first state, the event detection unit does not detect the first device management event within a predetermined time after detecting the second device management event. 6. The device management apparatus according to claim 3, wherein only when the state setting unit sets the device state to a second state. 7.   The device management apparatus according to claim 4, wherein the second device management function is a function that disables a specific function in the device.   The device management apparatus according to claim 7, wherein the first device management function is a function that can be used or disabled according to a specific situation.   The device management apparatus according to claim 4, wherein the second device management function is a function of protecting specific information in the device.   When the event detection unit detects a third device management event when the device state is the second state, the device management execution unit is set as the device management policy to be used. After executing the third device management function specified by the device management policy for the second state, the state setting unit sets the device state to the first state, and the policy management unit 6. The device management apparatus according to claim 4, wherein the device management policy for the first state is set as the device management policy to be used.   The third device management function is a function that enables a specific function in the device that has been disabled while the device state is the second state. Item 10. The device management apparatus according to Item 10.   The device management apparatus according to claim 10, wherein the third device management function is a function of restoring specific information in the device. The event accumulation unit accumulates the first device management event detected by the event detection unit,
The second state is a state where the event detection unit cannot detect the device management event,
The device management apparatus according to claim 10, wherein the third device management function includes at least a device management function for the first device management event stored in the event storage unit. The event accumulation unit accumulates the first device management event detected by the event detection unit when the device state is in the second state,
The event detection unit detects the third device management event, the state setting unit sets the device state to the first state, and the policy management unit sets the first device management policy. When the device management policy to be used is set, the device management execution unit determines the device management function to be executed according to the first device management event stored in the event storage unit. The device management apparatus according to claim 10.   15. The device management apparatus according to claim 13, wherein the event storage unit collectively changes the plurality of first device management events into another first device management event.   Between the management state immediately before the device state transitions from the first state to the second state and the management state immediately before the device state transitions from the second state to the first state The device management apparatus according to claim 10, wherein when there is a change, the device management execution unit executes the third device management function.   The first state is a state in which the predetermined management for the device can be performed, and the second state is a state in which the predetermined management for the device cannot be performed. The device management apparatus according to claim 3, wherein the device management apparatus is a device management apparatus.

Images